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IQ.  (C)  Summary.  QatarGas  is  in  the  midst  of  improving  its 
security  procedures  with  new  equipment,  better  training,  and 
more  security  personnel,  the  goal  is  to  be  ISO  28000 
compliant  in  the  next  two  years.  While  undergoing  physical 
improvements,  the  QatarGas  head  of  security  is  also  trying  to 
raise  security  awareness  amongst  all  Qatar  Gas  employees. 
QatarGas  has  a tepid  working  relationship  with  Qatar 
Petroleum,  which  can  influence  but  does  not  mandate  QatarGas 
security  procedures.  Cooperation  with  the  other  end  users  in 
Ras  Laffan  is  good,  but  they  complain  that  working  with  Ras 
Laffan  City  security  is  problematic  due  to  lacking 
communication.  Offshore  sites  remain  the  largest 
vulnerability  for  QatarGas,  although  officials  assess  an 
onshore  attack  is  more  likely.  The  Iranian  threat  is  another 
concern  but  the  U.S.  military  presence  in  Qatar  is 
reassuring.  End  Summary. 


MAKING  THE  BUSINESS  CASE 


_12 . (C)  Gordon  Penney,  QatarGas  Head  of  Security  told  Econoff 
on  March  8 that  his  largest  battle  is  convincing  people  that 
security  is  important  and  a necessary  part  of  the  overall 
business  plan.  Penney  presented  his  security  assessment  to 
QatarGas  senior  management  when  he  first  arrived  and  despite 
his  negative  results,  the  presentation  was  well-received  with 
an  attitude  towards  fixing  the  problems  and  moving  forward. 
Penney  claimed  QatarGas  will  be  the  world's  largest  producer 
of  liquefied  natural  gas  by  2010  and  as  such  his  work  to 
protect  the  investment  is  one  of  the  most  critical  aspects  of 
QatarGas  operations.  Penney  is  working  to  raise  awareness  of 
the  importance  of  security  throughout  the  company  and  wants 
QatarGas 1 mission  statement  changed  to  include  security  as  a 
company  value. 

13.  (C)  Penney  also  must  contend  with  the  vulnerabilities 
business  expansion  presents.  There  are  two  major  areas  within 
the  QatarGas  area  that  are  under  development.  These  areas 
will  have  30,000  workers  during  the  construction  phase  posing 
a serious  threat  to  the  current  security  environment.  There 
is  nothing  that  Penney  can  do  about  the  construction  workers 
because  those  contracts  were  set  before  he  arrived  and  he 
cannot  greatly  enforce  new  security  standards  on  the 
contractors.  However,  he  is  able  to  suggest  better  security 
practices  and  integrate  the  contractors  into  the  larger 
QatarGas  security  scene. 


IMPROVING  ONE  STEP  AT  A TIME 


14.  (C)  Penney  plans  to  have  a new  security  plan  in  place  in 
18  months.  He  has  spent  a large  portion  of  his  time 


assessing  what  vulnerabilities  existed  for  QatarGas  and  then 
developing  a plan  to  fix  them.  He  told  Econoff  he  felt 
"paralyzed"  because  there  was  so  much  work  to  be  done,  and  he 
did  not  know  where  to  start  first.  Penney  hired  new  security 
managers  who  are  responsible  for  IT  security,  training  of  the 
guard  force,  and  Ras  Laffan,  Doha,  port,  and  offshore 
operations.  This  allows  for  better  coverage  of  QatarGas' 
information  security,  personnel,  and  actual  LNG  production. 

15.  (C)  All  of  the  new  security  plans  and  procedures  are  being 
developed  with  an  eye  towards  conforming  to  ISO  28000,  a 2005 
standard  set  by  the  International  Organization  of  Standards 
that  manages  the  security  of  the  supply  chain.  Penney 
developed  a new  security  plan  to  include  hard  barriers, 
technological  security  measures,  and  a training  program  for 
security  guards  and  general  employees.  He  eventually  would 
like  have  a QatarGas  internal  quick  reaction  force  that  is 
authorized  to  use  lethal  force  if  necessary  and  is  currently 
working  with  QatarGas  lawyers  to  determine  the  legality  of 
armed  guards  under  Qatari  law. 

1.6.  (C)  After  the  Abqaiq  attack  in  Saudi  Arabia,  Ras  Laffan 
was  elevated  to  a level  3 security  posture  meaning  the 
country  is  facing  an  imminent  threat  and  Qatari  military 
forces  were  brought  in  to  protect  Ras  Laffan  City  (RLC).  The 
security  level  was  recently  raised  again  after  the  al  Qaida 
threats  against  all  energy  areas,  but  this  time  no  government 
forces  were  sent  to  support  RLC  security.  Penney  estimates 
QatarGas  would  be  ready  to  face  an  imminent  threat  in  the 
next  two  years.  Currently  he  feels  unable  to  counter  such  a 
threat  and  does  not  think  that  many  others  in  Qatar  are  ready 
either . 


TRAINING  MANDATED  FOR  ALL 
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1.7.  (C)  Penney  aims  to  increase  security  training  and 
awareness  for  all  QatarGas  employees,  not  just  the  guard 
force.  He  is  starting  a safety  program  for  the  corporate 
staff  to  raise  awareness  that  will  be  inaugurated  in 
September  when  QatarGas  opens  its  new  administrative  offices 
in  Doha.  The  program  will  be  one  week  and  include  basic 
physical  security  precautions  as  well  as  how  to  protect 
QatarGas 1 s proprietary  information.  QatarGas  has  challenges 
protecting  its  business  contract  information,  and  Penney 
would  like  to  start  a system  of  classifying  information  and 
using  secure  transfer  means  so  QatarGas  can  keep  its 
information  in-house. 

1.8.  (C)  For  the  guard  force,  Penney  is  instituting  a 6-7  month 
basic  training  for  the  entire  group  with  more  specialized 
training  for  shift  leaders,  armed  guards,  and  those  working 
offshore.  The  current  guards  will  remain  to  be  trained  in 
accordance  to  Penney ' s new  guidelines,  and  the  rest  will  be 
hired  pre-trained  for  weapons  use.  Penney  claimed  he  is  not 
under  any  pressure  to  hire  Qataris.  From  Econoff 
observations,  the  current  guard  force  is  mostly  workers  with 
the  local  G4  Security  company  who  were  not  armed  and  are 
charged  with  controlling  access  to  the  QatarGas  area  of  RLC. 


VARIED  WORKING  RELATIONSHIPS 


19.  (C)  Penney  opined  that  the  main  problem  with  Qatar's 
overall  security  infrastructure  is  that  there  are  no  checks 
and  balances  between  all  the  interested  parties.  He  stated 
that  Qatar  Petroleum  (QP)  is  the  "mother  ship"  and  ultimately 
has  the  final  say  in  all  of  the  security  measures  taken  by 
the  joint  venture  companies,  but  it  does  not  set  firm 
guidelines  on  security.  Penney  claimed  that  when  the  Giuliani 
group  was  in  Qatar  doing  a security  assessment  for  QP,  QP  ran 
interference  with  the  affiliated  companies  to  try  to  minimize 


a negative  assessment.  Penney  said  that  the  Giuliani 
assessment  still  did  a good  job  detailing  the  problems  and 
vulnerabilities  in  Qatar. 

11_10.  (C)  Penney  told  Econoff  that  he  has  a good  working 

relationship  with  the  international  partners,  but  they  are 
not  the  parties  that  are  most  involved  in  on  the  ground 
security.  Penney  also  works  well  with  the  other  end  users  in 
RLC  and  claims  they  all  have  a common  goal  of  improving  their 
security  measures.  This  is  important  because  should  an  attack 
occur,  the  other  end-users  could  be  first  responders  because 
of  their  proximity,  and  it  would  take  longer  for  RLC  or  the 
Qatari  military  to  arrive.  Working  with  RLC  is  more  tenuous 
because  the  industrial  city  is  not  good  at  sharing 
information  with  the  end  users.  Penney  said  that  with  the  new 
security  structure  recommended  by  the  Giuliani  group,  the  new 
Director  of  Security  would  have  jurisdiction  over  the 
industrial  cities,  but  some  mid-level  QP  officials  are 
impeding  the  change  because  they  do  not  want  to  give  up  their 
own  spheres  of  influence.  Penney  stated  that  the  new  Director 
of  Security  job  will  have  to  be  able  to  "run  the  show"  in 
order  to  get  all  of  the  interested  parties  to  cooperate  and 
work  effectively. 


CONCERNS  OF  OFFSHORE  AND  IRAN 


1.11.  (C)  Penney  stated  that  offshore  operations  give  him  the 

greatest  worry  because  they  are  harder  to  protect.  He  is  also 
worried  about  the  Iranian  situation  and  the  potential  for  a 
disruption  of  traffic  through  the  Straits  of  Hormuz  that 
would  prevent  a QatarGas  tanker  from  going  through.  He  is  not 
as  concerned  about  a direct  Iranian  strike  on  a QatarGas 
asset  because  of  the  U.S.  military  presence  in  Qatar — 
although  he  claimed  he  is  not  dependent  on  the  U.S.  military 
for  direct  support.  Despite  his  concerns  about  offshore 
attacks  and  Iran,  Penney  said  that  protection  of  onshore 
assets  is  the  most  critical.  He  also  feels  that  it  is  only  a 
matter  of  time  until  another  terrorist  attack  occurs  in  the 
region,  even  estimating  a 18-24  month  timeframe  for  an  event 
in  either  Qatar  or  the  United  Arab  Emirates  because  those 
countries  thus  far  have  remained  the  least  affected  in  the 
region . 


COMMENT 


11.12.  (C)  Penney  was  excited  to  speak  with  Econoff  and  would 
probably  welcome  further  USG  interaction.  Of  our 
interlocutors,  QatarGas  thus  far  appears  the  most  proactive 
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on  strengthening  its  security  infrastructure.  Penney  was  the 
only  contact  who  continually  linked  security  with  the 
financial  future  of  QatarGas  and  Qatar,  indicating  a greater 
strategic  understanding  than  most.  While  cooperation  between 
all  the  RLC  end  users  was  highlighted,  there  also  could  be  an 
air  of  competition  between  the  various  companies  as  Penney 
asked  Econoff  to  keep  ISO  28000  and  his  other  plans  shown 
close  hold.  As  each  end  user  continues  to  build  up  their 
infrastructure,  this  lack  of  communication  may  become  a 
disadvantage  for  the  end  users  should  a common  infrastructure 
or  plan  become  necessary  in  the  future. 
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